Control system and method of making the same

ABSTRACT

A control system and method of operating the control system are provided, the system having a supervisory circuit for detecting failure of the system and disabling a high energy control circuit of the system, the supervisory circuit having a capacitor therein for sustaining an on condition of a supervisory transistor that is in series with an output relay driver transistor of the high energy control circuit, and a temperature sensing unit that is disposed intermediate a microcomputer of the system and the supervisory circuit for continuing the charging of the capacitor only as long as the temperature sensing unit is sensing an output temperature effect of a heating unit of the system that is below a predetermined high temperature limit for the system and that terminates the charging of the capacitor when the sensed temperature is above the predetermined high temperature limit.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to a new control system and to a new method ofoperating the control system, the control system being particularlyadapted to be utilized for controlling the operation of a cookingapparatus or the like.

2. Prior Art Statement

It is known to provide a control system comprising a high energy controlcircuit means having an output relay driver transistor for operating aheating means of the system, manually operated means for initiating theoperation of the high energy control circuit means, microcomputer meansfor operating the high energy control circuit means after the manuallyoperated means has initiated the operation thereof, and supervisorycircuit means for detecting failure of the system and disabling the highenergy control circuit means if the system is not operating in a normalmode thereof, the supervisory circuit means having means requiring themanual operation of the manually operated means before permitting powerto reach the high energy control circuit means whereby the high energycontrol circuit means is disabled unless the manual operation of themanually operated means has taken place and the system is operating inthe normal mode thereof, the supervisory circuit means having asupervisory transistor therein that is in series with the relay drivertransistor and that must be switched on to enable the relay drivertransistor, the supervisory circuit means having a capacitor therein forsustaining the on condition of the supervisory transistor, the manuallyoperated means comprising means for initially charging the capacitor andswitching on the supervisory transistor when the manually operated meanshas been manually operated to initiate the operation of the high energycontrol circuit means, the system having means for continuing thecharging of the capacitor after the initial manual operation of themanually operated means if the system is operating in a normal modethereof. For example, see the copending patent application, Ser. No.939,872, filed Dec. 10, 1987 now U.S. Pat. No. 4,782,215.

It is also known to provide a control system for a cooking oven having aheating means and an oven door, the system comprising a high energycontrol circuit means having an output relay driver transistor foroperating an oven door latching motor means of the system, manuallyoperated means for initiating the operation of the high energy controlcircuit means, microcomputer means for operating the high energy controlcircuit means after the manually operated means has initiated theoperation thereof, and supervisory circuit means for detecting failureof the system and disabling the high energy control circuit means if thesystem is not operating in a normal mode thereof. For example, see theaforementioned copending patent application, Ser. No. 939,872, filedDec. 10, 1987.

SUMMARY OF THE INVENTION

It is one feature of this invention to provide a control system having aunique supervisory circuit means for monitoring the high energy controlcircuit means thereof.

In particular, it was found according to the teachings of this inventionthat the continuous charging of the sustaining capacitor for thesupervisory transistor of the supervisory circuit means can be providedby the temperature sensing means of the system so that not only willsoftware limits control the operation of the high energy control circuitmeans of the system, but also the hardware limits being provided by thetemperature sensing means will control the operation of the high energycontrol circuit means.

For example, the control system can be utilized for controlling theheating means of a cooking apparatus and the software of themicrocomputer means can provide a predetermined high temperature limitfor the system, such as 600° F., so that should the output temperatureeffect of the treating means exceed such high temperature limit, themicrocomputer means will terminate the operation of the high energycontrol circuit means that controls the heating means. However, inaddition, the temperature sensing means of the system can have a higherpredetermined high temperature limit, such as 635° F., so that shouldthe output temperature effect of the heating means exceed this hightemperature limit of the temperature sensing means, the supervisorycircuit means will terminate the operation of the high energy controlcircuit means that controls the heating means whereby this hardwarelimit is redundant to the software limit.

Thus, one embodiment of this invention provides a control systemcomprising a high energy control circuit means having an output relaydriver transistor for operating a heating means of the system, manuallyoperated means for initiating the operation of the high energy controlcircuit means, microcomputer means for operating the high energy controlcircuit means after the manually operated means has initiated theoperation thereof, and supervisory circuit means for detecting failureof the system and disabling the high energy control circuit means if thesystem is not operating in a normal mode thereof, the supervisorycircuit means having means requiring the manual operation of themanually operated means before permitting power to reach the high energycontrol circuit means whereby the high energy control circuit means isdisabled unless the manual operation of the manually operated means hastaken place and the system is operating in the normal mode thereof, thesupervisory circuit means having a supervisory transistor therein thatis in series with the relay driver transistor and that must be switchedon to enable the relay driver transistor, the supervisory circuit meanshaving a capacitor therein for sustaining the on condition of thesupervisory transistor, the manually operated means comprises means forinitially charging the capacitor and switching on the supervisorytransistor when the manually operated means has been manually operatedto initiate the operation of the high energy control circuit means, thesystem having means for continuing the charging of the capacitor afterthe initial manual operation of the manually operated means if thesystem is operating in a normal mode thereof, the means for continuingthe charging of the capacitor comprising temperature sensing means thatis disposed intermediate the microcomputer means and the supervisorycircuit means and continuing the charging of the capacitor only as longas the temperature sensing means is sensing an output temperature effectof the heating means that is below a predetermined high temperaturelimit for the system and that terminates the charging of the capacitorwhen the sensed temperature is above the predetermined high temperaturelimit.

It is another feature of this invention to use the temperature sensingmeans of the system to monitor the operation of the door latching motormeans of the control system when the system is being used to control thehigh temperature burn-off cleaning function of the heating means of anoven of a cooking apparatus.

For example, the software of the microcomputer means of the system canprovide a predetermined high temperature limit for the system, such as585° F., so that when the output temperature effect of the heating meansexceeds such high temperature limit, the microcomputer means willterminate the operation of the high energy control circuit means thatcontrols the door latching motor means so that such motor means cannotbe operated to unlatch the oven door until the output temperature effectfalls below the 585° F. limit. However, in addition, the temperaturesensing means of the system can have a higher predetermined hightemperature limit, such as 535° F., so that should the outputtemperature effect of the heating means exceed this high temperaturelimit of the temperature sensing means, the supervisory circuit meanswill terminate the operation of the high energy control circuit meansthat controls the door latching motor means whereby this hardware limitis redundant to the software limit.

Thus, another embodiment of this invention provides a control for acooking oven having a heating means and an oven door, the systemcomprising a high energy control circuit means having an output relaydriver transistor for operating an oven door latching motor means of thesystem, manually operated means for initiating the operation of the highenergy control circuit means, microcomputer means for operating the highenergy control circuit means after the manually operated means hasinitiated the operation thereof, and supervisory circuit means fordetecting failure of the system and disabling the high energy controlcircuit means if the system is not operating in a normal mode thereof,the supervisory circuit means having a supervisory transistor thereinthat is in series with the relay driver transistor and that must beswitched on to enable the relay driver transistor, the supervisorycircuit means having a capacitor therein for sustaining the on conditionof the supervisory transistor, the system having operating means forinitially charging the capacitor and switching on the supervisorytransistor to initiate the operation of the high energy control circuitmeans, the operating means being adapted to continue the charging of thecapacitor after the initial charging thereof if the system is operatingin a normal mode thereof, the operating means for continuing thecharging of the capacitor comprising temperature sensing means that isdisposed intermediate the microcomputer means and the supervisorycircuit means and continues the charging of the capacitor only as longas the temperature sensing means is sensing an output temperature effectof the heating means that is below a predetermined high temperaturelimit for the system and that terminates the charging of the capacitorwhen the sensed temperature is above the predetermined high temperaturelimit.

Accordingly, it is an object of this invention to provide a new controlsystem having one or more of the novel features of this invention as setforth above or hereinafter shown or described.

Another object of this invention is to provide a new method of makingsuch a control unit, the method of this invention having one or more ofthe novel features of this invention as set forth above or hereinaftershown or described.

Another object of this invention is to provide a new method of operatingsuch a control system, the method of this invention having one or moreof the novel features of this invention as set forth above orhereinafter shown or described.

Other objects, uses and advantages of this invention are apparent from areading of this description which proceeds with reference to theaccompanying drawings forming a part thereof and wherein:

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic front view of a control unit of this inventionthat uses the control system of this invention that is illustrated inFIG. 2.

FIG. 2 is a block diagram illustrating the various circuit sections ofthe electrical circuit means of the control system of this invention foruse in the control unit of FIG. 1, FIG. 2 being in block form andillustrates how the electrical circuit means is interconnected toexternal components to operate the same.

FIG. 3 is a block diagram illustrating how FIGS. 4A, 4B, 4C and 4D areto be arranged in order to illustrate the entire circuit means of thecontrol system of this invention.

FIGS. 4A, 4B, 4C and 4D respectively illustrate parts of the entireelectrical circuit means of the control system of this invention, FIGS.4A-4D being adapted to be arranged in the manner illustrated in FIG. 3to provide the entire circuit means for the control unit of FIG. 1.

FIG. 5 is a schematic view of the oven door lock timing feature of thecontrol system of FIGS. 4A-4D.

FIG. 6 is a schematic view of the oven door lock circuit.

FIG. 7 is a schematic view of the oven door lock inputs.

DESCRIPTION OF THE PREFERRED EMBODIMENT

While the various features of this invention are hereinafter illustratedand described as being particularly adapted to provide a control systemfor controlling a domestic cooking oven or the like, it is to beunderstood that the various features of this invention can be utilizedsingly or in any combination thereof to provide a control system forcontrolling other apparatus or appliances as desired.

Therefore, this invention is not to be limited to only the embodimentillustrated in the drawings, because the drawings are merely utilized toillustrate one of the wide variety of uses of this invention.

Referring now to FIG. 1, the new control unit of this invention isgenerally indicated by the reference numeral 20 and comprises a framemeans 21 having a visual display means 22, such as the well known vacuumfluoresecent display means as set forth in the U.S. Patent to Fowler,No. 4,568,927, and a user interface means 23 that comprise a rotaryswitch 24, such as one of the rotary switches as set forth in the U.S.Patent to Fowler et al, No. 4,625,084, and eight momentary contact pushbuttons S2, S3, S4, S5, S6, S7, S8 and S9 of conventional design thatremain in a normally open condition when released and therefore must beheld closed by the user in a manner well known in the art whereby theaforementioned two U.S. Pat. Nos. 4,568,927 and 4,625,084, are beingincorporated into this disclosure by the reference thereto.

The control unit 20 is a solid state, microcomputer based device capableof providing several advanced functions for home use, self-cleaningovens. When used in conjunction with the appropriate temperature sensorand door lock assembly, the control unit 20 provides the following mainfunctions: Time-of-Day Clock; Minute Timer with Alarm; Control of OvenTemperature in Bake, Broil, and Self-clean modes; Automatic Self-cleanMode; Delay start of Clean and Bake Modes; Timed Bake Modes and ControlOutput for Motorized Door Lock Mechanisms. Data entry is accomplishedwith the eight function keyes S2-S9 in conjunction with the rotaryswitch 24. The user selects a function with one of the keys S2-S9 andthen enters data via the rotary switch 24, in the manner fully set forthin the aformentioned patents. Information is displayed to the user bymeans of the vacuum fluorescent display 22. Time and oven temperatureinformation is displayed simultaneously. The display 22 is color codedfor ease of identification with time information being blue-green andtemperature information being red.

The control unit 20 has an electrical circuit means or control system ofthis invention therein which is generally indicated by the referencenumeral 25 in FIGS. 2 and 4, the system or circuit means 25 beingschematically illustrated by the dashed block 26 in FIG. 2 andcontaining sections of the electrical circuitry 25 as blocks 27, 28, 29,30, 31, 32, 33, 34, 35, 36 and 37.

The block 27 comprises the electrical power supply for the control unit20 and is adapted to be interconnected to an external power supply 38,FIG. 2, which comprises a Class 2, A.C. input and which in one workingembodiment of the invention is 21 VAC, 50/60 hz, the outputs of thepower supply block 26 for the circuit 25 being -VR, -VRD, VDD and VGG.

The block 28 comprises a 60 hz reference generator to provide the realtime reference signal utilized by the control unit 20 and the block 29comprises a power on reset to provide a reset state for the control unitwhenever insufficient voltage is available to properly power the controlunit 20.

The block 30 is an A/D converter and is adapted to be interconnected toan external RTD temperature sensor 39 for the oven (not shown) of thecooking apparatus (not shown) using the control unit 20.

The block 31 is the user interface means of the circuitry 25 thatcontains the eight push buttons on keys S2-S9 and the rotary switch 24.

The block 32 comprises a microcomputer that is hereinafter referred toas U2 in this description and in FIG. 4 of the drawings, themicrocomputer being conventional in the art and being programmed tofunction in a manner hereinafter set forth.

The block 33 comprises the display means 22.

The block 34 comprises a conventional EEPROM and is a sixteen by sixteenbit device that is hereinafter referred to as U3 in this description andin FIGS. 4A-4D of the drawings.

The block 35 comprises a free running oscillator U1 whose frequency is anominal 2.45 KHZ and drives a piezoelectric speaker Y1.

The block 36 comprises an oven interface means that has three outputsand a software monitored input from an externally interconnectedself-clean door lock mechanism, the outputs activating externallyinterconnected relays K1, K2 and K3 which, in turn, respectivelyactivate the oven door lock motor that is schematically illustrated byits external block 40 of FIG. 2 and the oven bake element and oven broilelement (as well as a down draft fan if required) that are schematicallyindicated by the external block 41 of FIG. 2.

The two outputs of the block 36 that control the heating elements mustpass current through the block 37 prior to enabling the element relaysK2 and K3, the block 37 comprising a watchdog circuit that suppliesredundant control of the heating elements by requiring a mechanical keyclosure prior to allowing power to reach the relays that control theheating elements in a manner hereinafter set forth.

In general, the system 25 of this invention is the same as the system 25of the aforementioned copending patent application, Ser. No. 939,872,filed Dec. 10, 1987, and since such copending patent application is nowallowed and has the issue fee therefor paid, the copending patentapplication, Ser. No. 939,872, filed Dec. 10, 1987 is being incorporatedinto this application by this reference thereto.

Therefore, the system 25 of this invention will now be described indetail with the understanding that certain details of the components andthe operation thereof that are not fully described hereinafter can beobtained from the aforementioned copending patent application. However,as previously stated, the new features of this invention concern thewatchdog or supervisory circuit means 37 and how the temperature sensingmeans controls the circuit means 37 and the door lock motor means 40 aswill be apparent hereinafter.

In the following description of the system 25 as illustrated in FIGS.4A-4D, all diodes are indicated by the reference letter D followed by areference numeral, all resistances are indicated by the reference letterR followed by a reference numeral, all capacitors are indicated by thereference letter C followed by a reference numeral, and all transistorsare indicated by the reference letter Q followed by a reference numeral.Also, unless otherwise indicated in the drawings, all capacitance valuesare in microfarads, 20% 50 V; all diodes are 1N4148 and all resistancevalues are in ohms, + or -5%, 0.25 watt.

The power supply block 27 is of conventional construction as illustratedin FIG. 4A and provides these voltages.

The -VFD supply provides approximately -27 V D.C. It is unregulated, andconsists of diode D1, diode D5 and capacitor C1. The A.C. output fromthe transformer secondary is applied to diode D1 and diode D5, forming ahalf-wave rectified signal used to charge capacitor C1. Capacitor C4provides a RFI/EMI decoupling function. The large, 1000 microfarad,capacitor C1 is used because of the long power interruption withstandrequirement placed on this design. Sufficient energy must be stored toallow continued microcomputer operation, without reset, for a maximum of3.5 seconds after power is removed. To improve this ability stillfurther, diode D4 also couples energy from the 470 microfarad capacitorin the -VR supply in the event of a power dip. This has practical valueonly if the relay outputs are off at the time of power interruption.This supply is used for the vacuum fluorescent display 22, the tonegenerator Y1 and the -15 volt regulator.

The -VR supply is of similar configuration to the -VFD supply. It isunregulated, and consists of diode D2, diode D3 and capacitor C3. TheA.C. output from the transformer secondary is applied to diode D2 anddiode D3, forming a half-wave rectified signal used to charge capacitorC3. This supply is used to provide power for the 24 V D.C. relay coilsK1', K2' and K3'. It will provide approximately -24 V D.C. when loadedwith 80 ma. of coil current from the relays K1, K2 and K3.

Due to the configuration of diodes D1-D5, the -VFD supply is independentof the -VR supply. The two supplies are charged from opposite phases ofthe incoming A.C. voltage. This minimizes voltage fluctuations as loadschange and balances the load placed on the power transformer.

The power transformer 38 must be of Class 2 construction and its outputmust be approximately 21 V A.C., 50/60 hz.

The -VGG supply provides a regulated source of low current -15 V D.C. Itconsists of resistor R9, transistor Q2 and zener diode Z3. Unregulated-27 V D.C. from the -VFD supply is applied to the collector oftransistor Q2 through current limit resistor R11. The base of transistorQ2 is tied to the junction of resistor zener diode R9 and Z3, which forma voltage divider producing a stable -15.6 V D.C. derived from the -VFDsupply. The circuits being powered by this supply become the emitterresistor for transistor Q2, whose current gain provides a stable sourceof voltage that is 0.6 V D.C. higher (due to Vbe rise of transistor Q2)than the reference voltage provided by zener diode Z3. Hence, a sourceof -15 V D.C. which maintains the voltage under varying load conditions.This supply is used to provide proper voltage for use by the A/Dcircuitry which decodes oven temperature. It is also used as apre-regulator for the -VDD supply, which powers the microcomputer U2.

The -VDD supply provides a regulated source of low current -5 V D.C. Itconsists of resistor R7, resistor R10, transistor Q1, transistor Q3 andsener diode Z2. Regulated -15 V D.C. from the -VGG supply is applied tothe collector of transistor Q3. The base of transistor Q3 is tied to thejunction of resistor R7, resistor R10 and the emitter of transistor Q1which form a voltage divider producing a stable 5.7 V D.C. derived fromthe -VGG supply. The circuits being powered by this supply become theemitter resistor for transistor Q3 whose current gain provides a stablesource of voltage that is 0.6 V D.C. higher (due to the Vbe rise oftransistor Q3) than the reference provided by transistor Q1. Hence asource of -5 V D.C. which is very stable due to the fact that the inputsource is already regulated. This supply is used to provide propervoltage for the microcomputer U2.

The power on reset block 29 comprises a circuit that provides a singlepulse that is applied to a reset input pin 49 of the microcomputer U2.The function is to provide monitoring of the -VFD supply and to placethe microcomputer U2 in a reset state whenever insufficient voltage isavailable to properly power the device. It does this by driving pin 49high under insufficient voltage conditions, which is the reset state ofthis input.

As power is applied to the control, the -VDF supply voltage rises at arate dependent on the value of capacitor C1 and the characteristicimpedance of the power transformer. The base emitter junction oftransistor Q1 and zener diode Z2 will not conduct until the -VFD voltageis greater than the combined voltage drops across these two components.With transistor Q1 off, the reset line is pulled to a high level, orlogic one, by the current path through resistor R5. A logic one is thenormal reset state. As the -VFD supply reaches approximately 5.7 V D.C.,transistor Q1 will turn on and switch the reset line to a low level, orlogic zero, through resistor R6 and enable normal microcomputeroperation. When the -VFD supply decreases to a level that is notsufficient to maintain the bias current through zener diode Z2 andtransistor Q1 base to emitter junction, transistor Q1 turns off and thereset line is pulled high level and the microcomputer U2 is in reset andstops operation. To improve the turn off threshold of transistor Q1 andallow bias current to flow through zener diode Z2 prior to transistor Q1turning on, resistor R7 has been included in the circuit. Capacitor C2has been added for noise immunity.

The 60 Hz reference generator block 28 comprises a circuit that providesthe real time reference signal used by the microcomputer U2 to generateaccurate Time-of-Day Clock, Timer, and other functions requiringconsistent real time response. It is basically an inverting, singletransistor amplifier, driven to saturation by a signal derived from theAC power line. This signal is taken directly from the power transformer.It is conditioned through a low pass filter to prevent errors due toelectrical noise on the AC line, before being applied to the base oftransistor Q4. The filter consists of resistor R13, resistor R14,capacitor C6 and resistor R12. Transistor Q4 inverts and squares up theincoming sinusoidal wave form before applying the resulting square wavesignal to pin 23 of the microcomputer U2. Resistor R15 is merely apull-down resistor, allowing the collector of transistor Q4 to swingbetween 0 and -5 V D.C. The function of capacitor C7 is to decoupleradiated RFI, which could upset timing accuracy if not suppressed. Sincefailure of this circuit would result in the microcomputer U2 losing thecapability to keep accurate time, this input is supervised in software.Inhibiting this signal will result in the error code -F6- beingdisplayed, an audible alarm, and all outputs shut down.

The tone generator block 35 comprises a circuit that consists of tonegenerator Y1, diode D13 and resistor R57. The microcomputer U2 switchesthe state of output pin 58 thereof causing tone generator Y1, apiezo-electric tone generator, to oscillate at a frequency controlled bythe switching speed of the output pin 58. Nominal speaker frequency is2.45 KHZ. Tone duration is controlled by the time of oscillation. Pin 58of the microcomputer U2 is coupled through diode D13 to the oscillator.Since this output of the microcomputer U2 is a 5 volt, CMOS output, thediode buffers the output from -27 volts. Resistor R57 provides currentlimiting to protect the output port.

The vacuum fluorescent display 22 is used to visually communicate thestatus of the control to the user. Feed back on which key was pushed,information on programmed operation, and error messages are alldisplayed. It consists of display DS1, resistor R1, resistor R2,resistor R3, resistor R4, and zener diode Z1. The resistors R1-R4 andzener diode Z1 are used to properly bias the filament of the display.The content of displayed information depends on the microcomputer U2,which uses a conventional multiplexing scheme to drive the 8 grid by 9segment display.

The user interface block 31 contains a rotary switch 24 and eight inputsfor eight external momentary contact push button switches S2-S9.Appliance operation is programmed by the user through use of theseswitches S2-S9.

The rotary switch 24 generates a two digit binary signal that is fedthrough resistor R29 and resistor R31 into the microcomputer U2, pins 20and 21. Resistors R30 and R32 are pull-down resistors to -VDD so thatproper logic level signals are generated. The microcomputer softwaredecodes which direction the rotary switch 24 is being turned andincrements or decrements the displayed reading accordingly.

The eight external momentary contact switches S2-S9 are used to selectwhich function the input from the rotary switch 24 will program.Resistors R34-R41 are buffering/coupling resistors to the microcomputerU2 from the switches S2-S9. Sip resistor R33 provides a pull down to-VDD for each switch.

The function keys S9, S8, and S7 are respectively Bake, Broil, and Cleankeys and are monitored in software for short circuit conditions thatcould cause unattended appliance operation. Any key held down for morethan 45 seconds results in error -F5- and an audible alarm. The Bake,Broil and Clean keys are also connected to the element watchdog circuitblock 37 and this circuitry will be hereinafter described.

One unique key is the Cancel key S-2. Because this design relies on thisswitch S-2 to provide a reliable, single button cancel of ovenoperation, its function is duplicated in hardware as well as software.The key S-2 is connected directly to the element watchdog circuit block37 as well as to the micro U2. If resistor R34 fails open or the microinput port fails there will be no effect on ability of the cancel key S2to turn all the elements off. If resistor R45 or diode D8 fail open thecancel key S2 will still input to the micro U2. The only failurecondition not detectable in this manner is a Cancel key contact thatwill not close.

The oven interface block 36 consists of three relay outputs and fourinputs. The outputs are simple transistor drivers Q8, Q11 and Q12 whichactivate external relays K1, K2 and K3 which in turn respectivelyactivate the door lock motor 42, the oven broil element 43 and the ovenbake element 44. The inputs monitor external switches.

When a Bake or Broil cycle is selected the corresponding output relay K3or K2 is energized. The relays are cycled under microcomputer control togenerate the desired oven cavity temperature for the entire cycle. Anexternal ON/OFF switch 45, FIG. 7, will inhibit the relay cycling whenopen. This switch 45 completes the circuit to ground for the relay coilsK1', K2' and K3'.

The Bake output driver circuit consists of resistor R74, resistor R75,resistor R76, capacitor C23, transistor Q12, and diode D20. When themicrocomputer output pin 60 is switched to a logic high and the elementwatchdog circuit 37 is active and functioning properly, transistor Q12switches power from the -VR supply into the K3 relay coil K3'. Diode D20protects transistor Q12 from inductive kickback from the relay coil K3'at turn off. Capacitor C23 provides a voltage boost at turn on of therelay K3 for fast contact closure, and to assure pull in at high ambienttemperatures. Resistors R75 and R76 provide a measure of currentlimiting for the relay coil K3' to reduce self heating in the coil K3'at the required hold in current. It was found necessary to use tworesistors in series due to their self heating and derating at hightemperatures.

The Broil output driver circuit consists of resistor R71, resistor R72,resistor R73, capacitor C22, transistor Q11, and diode D19. When themicrocomputer output pin 61 is switched to a logic high and the elementwatchdog circuit 37 is active and functioning properly, transistor Q11switches power from the -VR supply into the K2 relay coil K2'. Diode D19protects transistor Q11 from inductive kickback from the relay coil K2'at turn off. Capacitor C22 provides a voltage boost at turn on of therelay K2 for fast contact closure, and to assure pull in at high ambienttemperatures. Resistors R72 and R73 provide a measure of currentlimiting for the relay coil K2' to reduce self heating in the coil K2'at the required hold in current. It was found necessary to use tworesistors in series due to their self heating and derating at hightemperatures.

A failure of these circuits in the "on" condition would result inuncontrolled oven heating. Therefore redundant control of these outputdrivers transistor Q11 and transistor Q12 is provided. Before currentfrom the -VR supply can be supplied to the relay coil K2' or K3', theelement watchdog circuit 37 must be active and functioning properly ashereinafter set forth.

The door lock motor output driver circuit consists of resistor R62,resistor R63, capacitor C20 and diode D18. Diode D18 protects transistorQ8 from inductive kickback from the relay coil K1' at turn off.Capacitor C20 provides a voltage boost at turn on of the relay K1 forfast contact closure, and to assure pull in at high ambienttemperatures. Resistors R62 and R63 provide a measure of currentlimiting for the relay coil K1' to reduce self heating in the coil K1'at the required hold in current. It was found necessary to use tworesistors in series due to their self heating and derating at hightemperatures.

The door lock motor control circuit is composed of resistor R64,resistor R66, resistor R67 and transistor Q8. When the microcomputeroutput pin 59 is switched to a logic high and the door lock motorwatchdog circuit is active and functioning properly, transistor Q8switches power from the -VR supply into the K1 relay coil K1' providedtransistor Q10 of the door lock watchdog circuit is enabled on.

A failure of transistor Q10 in the "on" or motor running condition wouldresult in the oven door being unlocked and temperatures over 585° F.allowed by software limit. Therefore, redundant control of this outputdriver Q10 is provided. Before current from the -VR supply can besupplied to the relay coil K1', the door lock motor watchdog circuitmust be active and functioning properly as hereinafter set forth.

Pin 24 of the microcomputer U2 is the ON/OFF switch input. This inputswitch 45, FIG. 7, is a single pole, single throw (SPST) type and isprovided to signal the microcomputer U2 when all relay operation hasbeen inhibited. This input also provides external, hard wire, redundantcontrol of relay operation. This switch must be closed to complete therelay coil path to ground. The input circuit consist of resistor R54,resistor R55, capacitor C18 and diode D14. Resistor R54 is abuffering/coupling resistor of the microcomputer U2 from the switch.Resistor R55 provides a pull down to -VFD. Capacitor C18 providesRFI/EMI de-coupling. Pin 24 of the microcomputer U2 is a low voltagepin. Diode D14 protects the pin 24 from the pull down to -VFD.

Pin 25 of the microcomputer U2 is the door lock status switch input.This input switch 47, FIG. 7, is a SPST type and is actuated by the lockcam on the door lock motor assembly. It is provided to signal themicrocomputer U2 when the door lock motor 42 has locked the oven door,and because this input is connected to the door open/closed inputthrough a SPDT type switch it signals when the door open closed input isshorted to ground. This switch also completes the circuit to ground forthe voltage reference for the 935° F. oven temperature limit comparatorU1 in the A/D circuit hereinafter set forth. The input circuit consistsof resistor R61, capacitor C16 and diode D17. Resistor R61 is abuffering/coupling resistor to the microcomputer U2 from the switch.Capacitor C16 provides RFI/EMI de-coupling. Diode D17 protects the inputpin 25.

Pin 26 of the microcomputer U2 is the door lock phase status switchinput. This input switch 48, FIG. 7, is a SPST type and is actuated bythe phase cam on the door lock motor assembly. It is provided to signalthe microcomputer U2 when the door lock motor 42 is in the locking orunlocking portion of the lock cycle. The input circuit consists ofresistor R59, resistor R60, capacitor C17 and diode D16. This circuit isidentical in function to the input circuit for pin 24 described above.

Pin 27 of the microcomputer U2 is the door position switch. This inputswitch 46, FIG. 7, is DPST type and is actuated by the oven door. It isprovided to signal the microcomputer U2 that the door is open or closed.The input circuit consists of resistor R56, resistor R58, capacitor C19and diode D15. This circuit is identical in function to the inputcircuit for pin 24 described above.

Component failures of the input circuits, or the microcomputer inputs,must not allow a clean cycle when the oven door could be unlocked. Allfailures of these circuits will result in the termination of the cleancycle.

The A/D converter block 30 works in conjunction with the microcomputerU2 to decode the oven sensor resistance reading of the RTD sensor 39into a digital format, which may then be processed using digitaltechniques for control of oven temperature. The A/D function is actuallyachieved by a D/A technique first, which is then decoded as an A/Dresult.

Custom circuit R22, in a SIP package, is an 8 bit R/2R resistance laddernetwork with additions made to allow this particular circuit arrangementto operate. It is a thick-film, screened device, laser trimmed foraccuracy. The circuit is designed to be ratiometric to take advantage ofthis technology's inherent close tracking with temperature. The majorityof the controller's accuracy and repeatability over wide temperaturefluctuations is therefore established without adjustment at assemblyplant. Aging characteristics are believed to also be excellent.

Pins 4-11 of circuit R22 form the D/A ladder portion of the circuit.These pins 4-11 are tied directly to CMOS outputs of the microcomputerU2. The microcomputer U2 drives these 8 pins 4-11 with a sequentialbinary code, which results in a staircase wave form appearing at theoutput pin 12 of the sip R22. For every output code there is a known,accurate, analog voltage present at pin 12 of the sip R22.

The output of the ladder network is then fed into op amp U1, pin 9, atthe (-) input. This stage is configured as a unity gain, invertingamplifier, referenced to the -5 volt supply. Feedback and a resistorinternal to sip R22 sets the gain and assures temperature stability ofthe gain. The output of this op amp stage is a staircase signal whichstarts at a -5 volt level and ramps down to a maximum of -10 volts atthe highest output level of R22. This output voltage can be set to zerovolts through use of the probe enable line, pin 28 of the microcomputerU2 which is tied to the (+) input of the op amp U1 at the pin 10thereof. This function reduces power dissipation (self heating) in theoven sensor by shutting off this circuit when a reading is not required.

The output of op amp U1, pin 8, is used to apply a continuously varyingvoltage to the oven sensor 39. Resistors R23 and R26 are inserted inseries with the probe 39 and serve to buffer the op amp U1 from abusesof the outside world by providing a measure of current limiting. Theindustry requirement that a single component failure cannot result inoven temperature exceeding the maximum set point by 50° F. requiresusing two resistors in series instead of one. Shorting either resistorwill result in a maximum 44° F. positive calibration error. CapacitorC11 provides protection from high frequency disruptions. The other endof the oven sensor is connected to resistor R16, which returns the probecircuit to board common. Resistor R16 is a precision, low temperaturecoefficient resistor which is used to establish a voltage reference.

The probe 39 used to sense oven temperature is a platinum resistivetemperature device (RTD). This device 39 is exceptionally linear as tochange in ohms per change in unit temperature (about 2 ohms per degreeF). To decode temperature readings, an RTD is commonly excited with aconstant current source and the voltage that results tracks temperaturechange very linearly. It was found to be more cost effective to modifythis scheme slightly. Rather than excite the probe with a constantcurrent, it is excited with the ramping voltage of the D/A converter.This ramp increases the voltage applied across the probe 39 and, for agiven probe resistance, increases the current through the probe 39. Asthe temperature of the probe 39 increases, its resistance increases, andthe voltage required to achieve a reference current through the probe 39increases. Current through the probe circuit causes an accurate voltageto appear across resistor R16. This voltage is applied through impedancematching resistor R19, to the (-) input of op amp U1, pin 6. There, acomparison is made to a reference voltage established at pin 2 of thecustom sip R22 and applied to the (+) input pin 5 of the op amp U1. Thisreference voltage is not a precise absolute value, but instead has aratiometric relationship to the probe circuit voltage developed acrossresistor R16. It is approximately -3.48 volts. Because of theratiometric relationship, the D/A output and the reference voltage fromsip R22 will track accurately, independent of power supply voltage. Thiseliminates the need for a tightly controlled power supply to maintainaccuracy.

The result of this comparison is relayed to the microcomputer U2 throughbuffer resistor R20 from the op amp output, pin 7. When the voltageacross resistor R16 is more negative than the reference voltage from thesip R22, the output swings high and signals the microcomputer U2 to stopthe D/A ramp. The binary value necessary to produce the current levelthrough the RTD sensor 39 is decoded through software as a temperaturevalue. Resistor R18 acts as a pull-up to assure proper logic levels forthe microcomputer U2.

Capacitor C8 provides a little positive feedback to the op amp U1 tospeed the transition rate of the comparison.

The A/D circuit also works in conjunction with the microcomputer U2 anddiscrete components to check the temperature of the oven cavity andlimit the operation of the oven elements 43 and 44 to below 635° F. fornormal cooking operations, or to below 935° F. for cleaning operationprovided the oven cavity door is locked, and limit the operation of themotorized door lock motor 42 to below 535° F. for such cleaningoperation.

To test for the 635° F. limit during a normal cooking operation, all 8output lines 37-44 from the microcomputer U2 are pulsed high, giving themaximum output from the D/A ladder network R22. This voltage is input tothe op amp U1, pin 9, and causes the output, pin 8, to go to -10 V D.C.The output from pin 8 of op amp U1 is applied to the oven sensor 39 andthe voltage produced across resistor R16 is applied through impedancematching resistor R19 to the (+) input of op amp U1, pin 3. A comparisonis made to a reference voltage established by resistor R79, resistor R17and resistor R27, which are precision, low temperature coefficientresistors that form a voltage divider applied to the (-) input of op ampU1, pin 2. If the voltage across resistor R16 is more negative than thedivider voltage, the output of op amp U1, pin 1, will pulse low. If thevoltage across resistor R16 is more positive, the output will remainhigh.

As the temperature of the probe 39 increases, so does the voltage dropacross it. This results in smaller voltages input to the (+) input of opamp U1, pin 3. The value of the voltage applied to the op amp U1 fromthe divider network has been chosen such that at 635° F., the result ofthe comparison will not allow the output from pin 1 of the op amp U1 toswing low. This results in a loss of the dynamic or pulsing signal thatkeeps the watchdog circuit 37 enabled which is described hereinafter.

The test for the 935° F. limit during a cleaning operation is similar tothe 635° F. test. The 8 output lines 37-44 from the microcomputer U2 arepulsed high, giving the maximum output from the D/A ladder network R22.This voltage is input to the op amp U1, pin 9, and causes the output,pin 8, to go to -10 V D.C. The output from pin 8 of the op amp U1 isapplied to the oven sensor 39 and the voltage produced across resistorR16 is applied through impedance matching resistor R19 to the (+) inputof op amp U1, pin 3. A comparison is made to a reference voltageestablished by resistor R17 and resistor R27, which are precision, lowtemperature coefficient resistors that form a voltage divider applied tothe (-) input of op amp U1, pin 2. If the voltage across resistor R16 ismore negative than the divider voltage, the output of op amp U1, pin 1,will pulse low. If the voltage across resistor R16 is more positive, theoutput will remain high.

As the temperature of the probe 39 increases, so does the voltage dropacross it. This results in smaller voltages input to the (+) input of opamp U1, pin 3. The value of the voltage applied to the op amp U1 fromthe divider network has been chosen such that at 635° F. the result ofthe comparison will not allow the output from pin 1 of the op amp U1 toswing low.

The reference voltages established by resistor R17, resistor R27 andresistor R79 are dependent on the status of the door lock. If the dooris locked, resistor R17 is grounded through diode D6 and the door lockswitch and the reference voltage that is established by resistor R17 andresistor R27 will allow oven operation up to 935° F. If the door is notlocked, resistor R17 is in series with resistor R79 and the referencevoltage established by resistor R17, resistor R79 and resistor R27 willallow oven operation up to 635° F.

Oven temperature is tested by the microcomputer U2 against the 635°F./935° F. limits before every test against set temperature and everytest for set temperature occurs approximately once every second ofoperation of the system 25. If the oven cavity temperature is outside ofthe proper limit for the cycle in progress, the watchdog circuit 37 willno longer operate and the programmed cycle is reset and the ovenelements 43 and 44 are turned off.

The heart of the safety logic is contained in watchdog circuit 37. Thepurpose is to supply redundant control of the heating elements 43 and 44requiring a mechanical key closure prior to allowing power to reach therelays K2 and K3 that control the heating elements 43 and 44 andproviding a hardware shut off to remove power from the relays K2 and K3.Once a cooking cycle has been initiated, a dynamic signal from the A/Dcircuitry is required to sustain cooking. This dynamic signal is onlygenerated if the microcomputer U2 is functioning sufficiently to operatethe A/D circuit 30 and therefore to regulate the oven temperature. Inaddition, the watchdog hardware 37 is monitored with microcomputer U2through software to assure that the circuit 37 is functioning properlybefore allowing a heating mode to occur. This monitoring is continuous,and will result in a failure alarm should a fault be detected. Anysingle component fault of this circuit 37 will result in a safe shutdown, with the user being required to repair the fault prior torestoring use of the oven.

Should a single component failure in the bake or broil relay drivercircuits result in the microcomputer U2 being unable to shut the relaysK2 and K3 off during temperature regulation, the temperature in the ovenwill rise until the bake or clean temperature limits are reached. Atthis point the temperature limit comparators U1 can no longer providethe dynamic signal to the watchdog circuit 37. The watchdog circuit 37shuts off and removes power from the relays K2 and K3 in that manner.The microcomputer U2 will sound an alarm and display an error code.

Supervisory transistor Q7 is a redundant controlling element in serieswith the bake and broil relay driver transistors Q11 and Q12. TransistorQ7 must be on prior to either of these relays K2 and K3 receiving power.In order to turn transistor Q7 on, the following sequence must occur.

A function key S9, S8 or S7 (bake, broil or clean) must be pressed inthe User Interface circuit 31 that is attached through resistors R42-R44to the base of transistor Q5. The base of transistor Q5 is also tied to-VDD through resistor R50. The voltage created by the divider composedof resistor R42, or resistor R43, or resistor R44 and resistor R50 whena function key is pressed, is enough to turn transistor Q5 on but notenough to feed back false key press information to the microcomputer U2.When the transistor Q5 is turned on, current flows from -VDD through theemitter-collector junctions of transistor Q5, through current limitresistor R46, isolation diode D9 and into the branch circuit at thejunction of diode D11, capacitor C13 and resistor R49. Here, the currentsplits two ways, one path charging capacitor C13 from the -VDD supply,and the other path causing sufficient current to flow into thebase-emitter junction of transistor Q6 and resistor R48 to causetransistor Q6 to switch on in a saturated mode from emitter tocollector. When the transistor Q6 turns on, current flows into the baseemitter junction of transistor Q7 and resistor R51 to cause transistorQ7 to switch on in a saturated mode from collector to emitter.Transistor Q7 which is connected to the emitters of the Bake and Broilrelay driver transistors Q12 and Q11 is now allowing current from the-VR supply to reach these drivers Q12 and Q11. This, in effect,"enables" the drivers Q12 and Q11. This "enabling" does not turn relaysK2 and K3 on until the drivers Q12 and Q11 are also instructed to do soby the microcomputer U2 which occurs later in the sequence.

The microcomputer U2 must recognize that a key has been pressed in theUser Interface curcuit 31. Due to software de-bounce, the function keymust be held down long enough for capacitor C13 to receive an adequatecharge to keep transistor Q6 "on" upon release of the key. If it is notheld long enough, the microcomputer U2 simply ignores the key press andtransistor Q6 turns off because capacitor C13 discharges. Whentransistor Q6 turns off, transistor Q7 turns off and the relay driversQ12 and Q11 are disabled.

Assuming the key S9, S8 or S7 has been properly pressed, themicrocomputer U2 will decode it as an oven operating function and startthe A/D operating cycle. As previously stated, part of the A/D cycle istesting the oven temperature against 635° F./935° F. limits. If the oventemperature is within limits, a low output pulse from pin 1 of the oventemperature limit comparator U1 is generated. The limit comparator U1 isdiode isolated from the watchdog circuit 37 by diode D7. The signalpulses at about a 120 Hz rate and is AC coupled through capacitor C14and resistor R47 into the junction of diode D10 and diode D11.

Since the pulse generated by the limit comparator U1 is only able tosink current to -VGG, capacitor C14 is able to provide a "keep alive"current flowing into capacitor C13 only if the transistor Q6 was onprior to the start of the A/D operation. This is because the dischargepath for capacitor C14 is through diode D12 and resistor R53 and is onlyavailable if transistor Q6 is on.

The low pulse from pin 1 of the limit comparator U1 causes current toflow through the series circuit of resistor R47, resistor C14, diode D11and capacitor C13. Due to the relative values of capacitor C14, 0.47microfarad, and capacitor C13, 100 microfarad, a single charge cycle,will not produce sufficient voltage across capacitor C13 to energizetransistor Q6 unless several more closely spaced pulses occur. Sincecapacitor C13 was previously charged and transistor Q6 turned "on", by akey press, a discharge path for capacitor C14 is provided, when thesignal from the limit comparator U1 is high, through the path of diodeD10, transistor Q6 emittercollector, resistor R53, diode D12 andresistor R47. This discharge cycle allows current to flow from capacitorC14 into capacitor C13 on the next low pulse from the limit comparator.A pumping action results that charges capacitor C13 to an equilibriumvalue of about 14 V D.C. as long as the 120 Hz signal remains present.This is sufficient to keep transistor Q6 energized. If the temperaturelimit comparator U1 stops pulsing in either a high or low state, thepumping action of capacitor C14 into capacitor C13 stops, and capacitorC13 then discharges through resistor R48 and resistor R49, resulting intransistors Q6 and Q7 shutting off. It would require a key press beforetransistors Q6 and Q7 could once again be turned on.

To insure that no hardware malfunctions have occurred that would causetransistor Q6 to turn on without the proper key sequence and sustainingsignal, a simple monitoring scheme is employed. Pin 18 of themicrocomputer U2 is the watchdog monitor input. Through resistor R77,the state of the collector of transistor Q7 is checked on a continuousbasis. An alarm sounds and the relay driver outputs are inhibited if thecollector of transistor Q7 is in the wrong state for the presentoperating mode of the control. For example, if transistor Q7 is detectedas being "on" for more than a few seconds with no cooking functionselected, an alarm sounds and a characteristic failure code appears inthe display. Conversely, if transistor Q7 if "off" during a legitimatecook or clean cycle, the mode is cancelled. This failure is not a safetyconcern, but the appliance will not cook under this condition.

Through this handshaking arrangement of hardware and software, it isimpossible for a single open or shorted component to cause an unattendedstart of the appliance. The failure analysis confirms that the watchdogcircuitry 37 inhibits operation in the event of a microcomputer U2failure and the microcomputer U2 protects against a hardware failure.

Similar to the oven temperature comparator limits, the D/A circuit 30also provides a door lock limit comparator. This limit is typically 535°F. and has the function of inhibiting operation of the door lock motor42 above the limit established by specification of discrete components.

To test for the 535° F. limit, all 8 output lines 37-44 from themicrocomputer U2 are pulsed high, giving the maximum output from the D/Aladder network R22. This voltage is input to the op amp U1, pin 9, andcauses the output, pin 8, to go to -10 V D.C. The output from pin 8 isapplied to the oven sensor 39 and the voltage produced across resistorR16 is applied through impedance matching resistor R19 to the (+) inputof op amp U1, pin 3. A comparison is made to a reference voltageestablished by resistor R21 and resistor R25 which are precision, lowtemperature coefficient resistors that form a voltage divider applied tothe (-) input of op amp U1, pin 13. If the voltage across resistor R16is more negative than the divider voltage, the output of op amp U1, pin14 will pulse low. If the voltage across resistor R16 is more positive,the output will remain high.

As the temperature of the probe 39 increases, so does the voltage dropacross it. This results in smaller voltages input to the (+) input of opamp U1, pin 12. The value of the voltages applied to the op amp U1 fromthe divider network has been chosen such that at 535° F., the result ofthe comparison will not allow the output from pin 14 of the op amp U1 toswing low.

Oven temperature is tested against the 535° F. limit before every testagainst set temperature. If the oven cavity temperature is outside ofthe proper limit for the motorized door lock operation, the dynamicsignal to the door lock watchdog circuit 37 will be inhibited. This willinhibit operation of the door lock motor 42 as explained hereinafter.

Another purpose of the watchdog circuit 37 is to provide redundantcontrol of the door lock motor 42, requiring the dynamic signalgenerated by the A/D and the door lock temperature limit comparator U1prior to allowing power to reach the relay K1 that controls the doorlock motor 42, and providing a hardware shutoff to remove power from thedoor lock motor 42. This dynamic signal is only generated if themicrocomputer U2 is functioning sufficiently to operate the A/D andtherefore to regulate the oven temperature. In addition, the watchdoghardware is monitored through software to assure that the circuit 37 isfunctioning properly before allowing the door lock relay K1 to operate.Should a fault be detected, this monitoring will result in a failurealarm. Any single component fault of this circuit will result in notbeing able to operate the door lock motor 42 or start a clean cycle. Thefault must be repaired prior to restoring full use of the oven.

Should a single component failure in the door lock relay driver circuitresult in the microcomputer U2 being unable to shut the relay K1 off,the temperature in the oven will rise until the door lock temperaturelimit is reached. At this point the temperature limit comparator U1 canno longer provide the dynamic signal to the watchdog circuit 37. Thewatchdog circuit 37 shuts off, and removes power from the relay K1 inthis manner. The microcomputer U2 will sound an alarm and display afailure code.

Supervisory transistor Q10 is the redundant controlling element inseries with the door lock relay driver transistor Q8. It must be onprior to this relay receiving power. In order to turn transistor Q10 on,the following sequence must occur.

The Clean function key 57 must be pressed in the User Interface circuit31 to start the A/D operating cycle. As previously stated, part of theA/D cycle is used to test the oven temperature against the 525° F.limit. If the oven temperature is within limits, a low output pulse frompin 14 of the door lock temperature limit comparator U1 is generated.The signal pulses at about a 120 Hz rate and is AC coupled throughcapacitor C10 and resistor R24 into the base of transistor Q9.

A low pulse from pin 14 of the limit comparator U1 causes transistor Q9to turn on. When transistor Q9 turns on, current flow will begin tocharge capacitor C21. A single pulse will not produce enough voltageacross capacitor C21 to turn resistor Q10 on. Only if there is acontinuous series of charge pulses will capacitor C21 charge enough toturn transistor Q10 on and keep it on. If the door lock temperaturelimit comparator stops pulsing in either a high or low state, capacitorC9 will turn off and the pumping of charge into capacitor C21 will stop.Capacitor C21 then discharges through resistor R69 and resistor R70,resulting in transistor Q8 shutting off.

To insure that no hardware malfunctions have occurred that enable thedoor lock motor 42 to run without the proper key sequence and sustainingsignal, a simple monitoring scheme is employed. Pin 59 of themicrocomputer U2 is the door lock motor control output. When it isneeded to monitor the door lock hardware, however, this pin 59 isreconfigured for input. Through resistors R64 and R67, the state of theemitter of transistor Q10 can be checked. If transistor Q10 is detectedas being "on" for more than a few seconds with the oven temperatureabove the motor disable temperature, an alarm sounds and acharacteristic failure code appears in the display 22.

Through this handshaking arrangement between hardware and software, itis impossible for a single component failure to allow the door to unlockwhen the oven temperature is above 585° F. The failure analysis confirmsthat the watchdog circuitry 37 inhibits operation in the event ofmicrocomputer U2 failure, and the microcomputer U2 inhibits operation inthe event of a hardware failure.

The control system 25 operates with suitable mechanism for locking theoven door while cleaning. For example, the motorized door lock assembly(not shown) can consist of a 115 V A.C. gear motor 42, a phase cam and alock cam on the motor shaft, and a DPST switch 46, FIG. 7, and two SPSTswitches 47 and 48, FIG. 7. Refer to FIG. 5 for door lock timing.

FIG. 5 illustrates door lock timing and FIGS. 6 and 7 respectivelyillustrate the wiring for the door lock motor 42 and the external wiringfor the door lock inputs to the system 25.

To lock the oven door, the output relay K1 for the door lock motor 42 isenergized and operates until the lock cam on the motor shaft causes thedoor lock status switch 47 to close and the phase cam causes the doorlock phase switch 48 to close. When both of these switches 47 and 48 areclosed the output relay K1 is de-energized by the microcomputer U2. AClean cycle will not start unless both of these switches 47 and 48 andthe door position switch 46 are closed.

The motorized door lock assembly must not attempt to lock the oven doorunless the door is shut. To insure that a short to ground in the doorposition input line does not cause the microcomputer U2 to run the doorlock motor 42 when the door is open, a simple monitoring scheme isemployed. The normally closed contact 49 of the DPST door positionswitch 46 is connected to the lock status input. A short to ground inthe door position switch wiring will result in the door appearing lockedwithout the door lock phase input being closed. This will cause an alarmto sound and characteristic failure code to appear in the display 22.

To unlock the door the output relay K1 for the door lock motor 42 isenergized by the microcomputer U2 and the door lock motor 42 operatesuntil the phase cam on the motor shaft causes the door lock phase switch48 to open. When this switch 48 opens the output relay K1 isde-energized.

Thus, it can be seen that this invention provides a new control systemand a new method of operating such a control system as well as a newmethod of making such a control system.

While the forms and methods of this invention now preferred have beenillustrated and described as required by the Patent Statute, it is to beunderstood that other forms and method steps can be utilized and stillfall within the scope of the appended claims wherein each claim setsforth what is believed to be known in each claim prior to this inventionin the portion of each claim that is disposed before the terms "theimprovement" and sets forth what is believed to be new in each claimaccording to this invention in the portion of each claim that isdisposed after the terms "the improvement" whereby it is believed thateach claim sets forth a novel, useful and unobvious invention within thepurview of the Patent Statute.

What is claimed is:
 1. In a control system comprising a high energycontrol circuit means having an output relay driver transistor foroperating a heating means of said system, manually operated means forinitiating the operation of said high energy control circuit means,microcomputer means for operating said high energy control circuit meansafter said manually operated means has initiated the operation thereof,and supervisory circuit means for detecting failure of said system anddisabling said high energy control circuit means if said system is notoperating in a normal mode thereof, said supervisory circuit meanshaving means requiring the manual operation of said manually operatedmeans before permitting power to reach said high energy control circuitmeans whereby said high energy control circuit means is disabled unlesssaid manual operation of said manually operated means has taken placeand said system is operating in said normal mode thereof, saidsupervisory circuit means having a supervisory transistor therein thatis in series with said relay driver transistor and that must be switchedon to enable said relay driver transistor, said supervisory circuitmeans having a capacitor therein for sustaining the on condition of saidsupervisory transistor, said manually operated means comprising meansfor initially charging said capacitor and switching on said supervisorytransistor when said manually operated means has been manually operatedto inititate the operation of said high energy control circuit means,said system having means for continuing the charging of said capacitorafter the initial manual operation of said manually operated means ifsaid system is operating in a normal mode thereof, the improvementwherein said means for continuing the charging of said capacitorcomprises temperature sensing means that is disposed intermediate saidmicrocomputer means and said supervisory circuit means and continues thecharging of said capacitor only as long as said temperature sensingmeans is sensing an output temperature effect of said heating means thatis below a predetermined high temperature limit for said system and thatterminates the charging of said capacitor when said sensed temperatureis above said predetermined high temperature limit.
 2. A control systemas set forth in claim 1 wherein said control system is for a cookingapparatus that has an oven and said predetermined high temperature limitis approximately 635° F. for a cooking operation in said oven.
 3. Acontrol system as set forth in claim 1 wherein said control system isfor a cooking apparatus that has an oven and said predetermined hightemperature limit is approximately 935° F. for a high temperaturecleaning operation in said oven.
 4. A control unit as set forth in claim1 wherein said means for continuing the charging of said capacitorcomprises AC coupling means.
 5. A control unit as set forth in claim 4wherein said means for initially charging said capacitor comprises atransistor that is temporarily switched on by the manual operation ofsaid manually operated means.
 6. A control unit as set forth in claim 1wherein said high energy control circuit has another output relay drivertransistor that is also in series with said supervisory transistor andin parallel with the first-mentioned output relay driver transistor. 7.A control unit as set forth in claim 6 wherein said manually operatedmeans comprises a plurality of electrical switch means respectivelyoperatively associated with said output relay driver transistors throughsaid microcomputer.
 8. In a control system for a cooking oven having aheating means and an oven door, said system comprising a high energycontrol circuit means having an output relay driver transistor foroperating an oven door latching motor means of said system, manuallyoperated means for initiating the operation of said high energy controlcircuit means, microcomputer means for operating said high energycontrol circuit means after said manually operated means has initiatedthe operation thereof, and supervisory circuit means for detectingfailure of said system and disabling said high energy control circuitmeans if said system is not operating in a normal mode thereof, theimprovement wherein said supervisory circuit means has a supervisorytransistor therein that is in series with said relay driver transistorand that must be switched on to enable said relay driver transistor,said supervisory circuit means having a capacitor therein for sustainingthe on condition of said supervisory transistor, said system havingoperating means for initially charging said capacitor and switching onsaid supervisory transistor to initiate the operation of said highenergy control circuit means, said operating means being adapted tocontinue the charging of said capacitor after the initial chargingthereof if said system is operating in a normal mode thereof, saidoperating means for continuing the charging of said capacitor comprisingtemperature sensing means that is disposed intermediate saidmicrocomputer means and said supervisory circuit means and continues thecharging of said capacitor only as long as said temperature sensingmeans is sensing an output temperature effect of said heating means thatis below a predetermined high temperature limit for said system and thatterminates the charging of said capacitor when said sensed temperatureis above said predetermined high temperature limit.
 9. In a method ofoperating a control system that comprises a high energy control circuitmeans having an output relay driver transistor for operating a heatingmeans of said system, manually operated means for initiating theoperation of said high energy control circuit means, microcomputer meansfor operating said high energy control circuit means after said manuallyoperated means has initiated the operation thereof, and supervisorycircuit means for detecting failure of said system and disabling saidhigh energy control circuit means if said system is not operating in anormal mode thereof, said supervisory circuit means having meansrequiring the manual operation of said manually operated means beforepermitting power to reach said high energy control circuit means wherebysaid high energy control circuit means is disabled unless said manualoperation of said manually operated means has taken place and saidsystem is operating in said normal mode thereof, said supervisorycircuit means having a supervisory transistor therein that is in serieswith said relay driver transistor and that must be switched on to enablesaid relay driver transistor, said supervisory circuit means having acapacitor therein for sustaining the on condition of said supervisorytransistor, said manually operated means comprising means for initiallycharging said capacitor and switching on said supervisory transistorwhen said manually operated means has been manually operated to initiatethe operation of said high energy control circuit means, said systemhaving means for continuing the charging of said capacitor after theinitial manual operation of said manually operated means if said systemis operating in a normal mode thereof, the improvement comprising thestep of continuing the charging of said capacitor with temperaturesensing means that is disposed intermediate said microcomputer means andsaid supervisory circuit means and continues the charging of saidcapacitor only as long as said temperature sensing means is sensing anoutput temperature effect of said heating means that is below apredetermined high temperature limit for said system and that terminatesthe charging of said capacitor when said sensed temperature is abovesaid predetermined high temperature limit.